Crontab remove

[Paul_481]

Guys,

Need help here, I am running on HPUX 11.00. I came to the office this morning and found that on of the user profile's crontab are gone as well as the command prompt of the user is change. This username is an application user.

The only clue that I have is the .profile of the user was modified around 0007H ( Dec 17).

Is there a way to check how that happened?

Thanks,

Paul

[Fred Ruffet]

You can try to see his last connections and last root's connection with the "last" command.

Maybe there are still traces in .sh_history in user's and root home directories.

Regards,

Fred

[Paul_481]

Problem is /var/adm/wtmp is non-existent.

[Robert-Jan Goossens]

Hi Paul,

Does this user have a history file ?

# cat /$HOME/.sh_history

Regards,
Robert-Jan

[Paul_481]

yes it has, but i cant see any command executed that could remove the cron.

Currently the system don't have any /var/adm/wtmp. How do I recreated it?

Regards,

Paul

[Fred Ruffet]

What about root's .sh_history ?

(I don't know what process populates wtmp file)

Regards,

Fred

[Bill Hassell · Accepted solution]

From the wtmp man page:

"Also note that wtmp and btmp are not created by the programs that maintain them. Thus, if these files are removed, record-keeping is turned off."

Oops. Some root user probably saw wtmp getting large and simply removed it (ouch!) so commands like last will no longer produce anything. wtmp can be created with:

touch /var/adm/wtmp
chmod 664 /var/adm/wtmp
chown adm:adm /var/adm/wtmp

Also make sure that /var/adm/btmp exists. If not, use the touch/chmod/chown as above BUT make sure chmod is 640 (NO ONE gets to read btmp except root). lastb is the command that formats the btmp file.

As far as the culprit that made the changes, the user may not have made the changes, a root user ocould have done the deed. Check for duplicate root users:

logins -d

Multiple UID=0 is a BIG security no-no and one of the first hacks made by an intruder. You can also grep through all the /home/*/.sh_history files:

grep username /home/*/.sh_history

Also check if any of the HOME directories have missing .sh_history files, zero'ed .sh_history files, or the permission/ownership on the .sh_history file prevents the owner's shell from recording any commands. Any of those 3 conditions needs to be investigated.

[Stuart Abramson]

Reload the missing files from Backup Tapes.

You had better have Backup Tapes.

[Paul_481]

Thanks everyone for the reply, points will be assigned later.

I happened to look at the console of the server and on the screen it has "cron job aborted " message.

Any ideas on what it mean?

[Nguyen Anh Tien]

1. Check .profile to determine whether history is set or not
vi /$USER_HOME_DIRECTORY/.profile
--- search this line---
export HISTFILE=/.sh_history
if it exits, history is set on your system for that user.

2. If user have a history file, check user's history file to know what happend
# vi /$USER_HOME_DIRECTORY/.sh_history